DIVA - Insecure Logging

The first challange in DIVA is Insecure Logging
1-1
1-2
Now to analyze our logs we will open logcat on the android studio
1-3
If we open this we can see the logs the application is feeding with its stack trace when it generates any errors.
1-4
Let’s feed the application with any random number to create an error
1-5
And click on checkout
1-6
As you can see the credit card number which we feed in the application is visible in logcat which is considered as an Insecure Logging vulnerability.
Let’s decomplie/unpack the APK to analyz the code which cause this vulnerbality in the application.
Unzip the apk file
1-7
Classes.dex this is what we need
1-8
1-9
1-10
Inside ./jakhar/aseem/diva we can find the file LogActivity.class which have vulnerable code which we are looking for
1-11
Again we need to breakdown the file into normal readable text but this time we will use a different toll (jad)
I guess in new kali 2020 they removed the jad from the repo
You can download it from gitlab-jad
1-12
1-13
1-14
As you can see this is the piece of code which logs the data of credit card no. from the application in Logcat.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Log.e(“diva-log”, (new StringBuilder()).append(“Error while processing transaction with credit card: “).append(edittext.getText().toString()).toString());
Toast.makeText(this, “An error occured. Please try again later”, 0).show();
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++